Utah's VPN Law: The Quiet Death of Internet Anonymity

Utah quietly passed something most Americans haven’t noticed yet. Under a new state law, if a user fires up a VPN to dodge age verification, the website takes the legal hit — not the user. It sounds like a niche fix for a niche problem. It’s actually a wrecking ball aimed at the foundations of how the open internet operates.

What Actually Changed

Age verification laws used to follow a simple bargain. Websites had to make a reasonable effort to confirm a user’s age. If someone lied on a form or spoofed their location, that was on them. The site got a safe harbor.

Utah just torched that bargain. The new statute pushes VPN detection and blocking onto the website itself. If a minor slips through using a commercial VPN, the platform — not the kid, not the parent, not the VPN provider — eats the liability. In practice, that’s a quiet command to treat every VPN user as a potential minor until proven otherwise.

VPNs Aren’t Easy to Block

Here’s the technical problem regulators keep waving away. Detecting VPN traffic with anything close to 100% accuracy is essentially impossible. Sure, the IP ranges of NordVPN, ExpressVPN, and the other big consumer brands are well-cataloged and easy to blocklist. But anyone running WireGuard or OpenVPN on a $5 DigitalOcean droplet looks like ordinary residential traffic. There’s no clean signature to match.

And VPNs aren’t a tool for criminals and teenagers. Remote workers use them to reach corporate networks. Travelers use them on hotel Wi-Fi. Journalists in hostile environments depend on them. Privacy-conscious users in coffee shops use them every day. Under Utah’s framing, all of these people become suspect by default. From a website’s risk-management perspective, the safest move is to block any traffic that smells unusual — and err aggressively on the side of blocking.

The Real Endgame: Hard ID for Everyone

Here’s where it gets ugly. The only durable way for a website to limit its liability is to strengthen identity verification across the board. Not just for VPN users. For everyone. Government ID scans, facial recognition, credit card-based age checks, full KYC pipelines borrowed from banking — these become the new floor.

Today, most sites only escalate verification when something looks off. The Utah model flips that: every visitor is a verification event. And because the modern web doesn’t respect state lines, a Utah-only statute effectively sets policy for every American consumer service. One state’s legislature is rewriting the default settings of the internet.

A Patchwork That Forces the Strictest Standard

This isn’t going to stay confined to Utah. Texas, Louisiana, and Mississippi already have aggressive age-verification regimes on the books, and adding VPN-liability language is a copy-paste job. When 50 states write 50 versions of the same idea, websites can’t tailor experiences state by state. They default to the strictest one. That’s how compliance always works.

The EFF and other digital rights groups are gearing up to argue these laws violate the First Amendment — specifically the right to anonymous speech, a doctrine the Supreme Court has historically taken seriously. The 2025 SCOTUS ruling in Paxton (the Texas age-verification case) already weakened that protection for adult content. If a VPN-liability case lands at the Court, the question is whether anonymity survives as a meaningful concept anywhere online.

The Quiet Part Out Loud

The packaging is child safety. The mechanism is mandatory ID for every adult who wants to read, post, or browse. Those aren’t the same goal, and pretending they are is how we got here.

We’ve spent thirty years assuming internet anonymity was a baseline, even a birthright. Utah’s bill is a small reminder that it was always a policy choice — and policy choices can be unmade. The question now isn’t whether anonymity online is dying. It’s whether anyone with the power to save it actually wants to.